← Back to Microsoft Windows 10 Security Technical Implementation Guide

V-220718

CAT I (High)

Internet Information System (IIS) or its subcomponents must not be installed on a workstation.

Rule ID

SV-220718r569187_rule

STIG

Microsoft Windows 10 Security Technical Implementation Guide

Version

V2R9

CCIs

CCI-000381

Discussion

Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted. Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.

Check Content

IIS is not installed by default.  Verify it has not been installed on the system.

Run "Programs and Features".
Select "Turn Windows features on or off".

If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, this is a finding.

If an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO.  In addition, any applicable requirements from the IIS STIG must be addressed.

Fix Text

Uninstall "Internet Information Services" or "Internet Information Services Hostable Web Core" from the system.